PT-2024-35952 · Unknown · Centurion Erp

Jon-Nfc · Published 2024-11-27 · Updated 2025-09-23 · CVE-2024-53855

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Centurion ERP versions prior to 1.3.1

Description: A user with view permissions for a ticket can view the tickets of another organization they are not a part of, if they have specific permissions such as view ticket change, view ticket incident, view ticket request, or view ticket problem. This issue is applicable when browsing the API endpoints for the tickets in question and does not affect the Centurion UI or Project Tasks.

Recommendations: For versions prior to 1.3.1, upgrade to release version 1.3.1 to address the issue. As a temporary workaround, consider removing the ticket view permissions from users to alleviate this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2024-53855

GHSA-H9Q2-FCC6-R65C

Affected Products

Centurion Erp

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53855.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-53855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53855 · Security Note
• https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-h9q2-fcc6-r65c · Vendor Advisory
• https://github.com/nofusscomputing/centurion_erp/pull/399/commits/61f34876ed0f8362f7185bd5eecfc830a9de5cb0 · Patch
• https://twitter.com/CVEnew/status/1861844077253210408 · Twitter Post
• https://t.me/cveNotify/136143 · Telegram Post
• https://github.com/nofusscomputing/centurion_erp/releases/tag/1.3.1 · Note
• https://github.com/nofusscomputing/centurion_erp/pull/399 · Note